CVE-2024-10041: Pam: libpam: libpam vulnerable to read hashed password
First published: Wed Oct 16 2024(Updated: )
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Linux-PAM | ||
| Any of | ||
| Red Hat Enterprise Linux | =7.0 | |
| Red Hat Enterprise Linux | =8.0 | |
| Red Hat Enterprise Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-10041?
CVE-2024-10041 is classified as a high severity vulnerability due to the potential for an attacker to exploit it to execute arbitrary code.
How do I fix CVE-2024-10041?
To fix CVE-2024-10041, users should update to the latest version of PAM that addresses this vulnerability.
What does CVE-2024-10041 affect?
CVE-2024-10041 affects Linux PAM implementations, particularly in environments using vulnerable versions of Red Hat Enterprise Linux.
Who can be affected by CVE-2024-10041?
Users and systems running vulnerable versions of Linux PAM on Red Hat Enterprise Linux are at risk of exploitation due to CVE-2024-10041.
Is there a workaround for CVE-2024-10041?
Currently, the recommended approach is to apply updates, as there are no effective workarounds documented for CVE-2024-10041.
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/severity
- agent/weakness
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/softwarecombine
- agent/source
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-10041
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/linux-pam
- canonical/linux-pam
- vendor/redhat
- canonical/red hat enterprise linux
- version/red hat enterprise linux/7.0
- version/red hat enterprise linux/8.0
- version/red hat enterprise linux/9.0